Deloitte
Governance and PMO Specialist, Cyber Operate
- Permanent
- Riyadh, Saudi Arabia
- Experience 5 - 10 yrs
Job expiry date: 28/11/2026
Job overview
Date posted
14/10/2026
Location
Riyadh, Saudi Arabia
Salary
Undisclosed
Compensation
Comprehensive package
Experience
5 - 10 yrs
Seniority
Experienced
Qualification
Bachelors degree
Expiration date
28/11/2026
Job description
Every decision in a large cybersecurity programme needs an owner, a forum and a record, and building that structure is the job of this Governance & PMO Specialist in Deloitte's Cyber Operate team in Riyadh. The governance framework sets decision rights, roles and RACI across the CISO office, IT, OT, risk, legal, procurement and business units. Beneath it sits a full policy suite, from top-level policy down to SOPs, mapped to NCA ECC-2:2024 and moved through drafting, review, approval, publication and periodic update. ISMS governance components toward ISO/IEC 27001:2022 are maintained alongside it. Steering committees and working groups run on charters, agendas, decision packs and minutes that you prepare, with actions followed to closure. PMO work covers the integrated programme plan in MS Project, Primavera or Smartsheet, the RAID log, change control, resourcing and budget tracking. Weekly and monthly status reports, Power BI dashboards and executive summaries keep leadership informed, while quality reviews and formal acceptance govern every deliverable. A well-kept document repository means evidence is easy to find when auditors or regulators ask. Expect to bring 5 to 10 years of experience, working knowledge of NCA ECC, ISO/IEC 27001 and NIST CSF 2.0, and ideally a PMP, CISM or CGEIT, with Arabic a plus.
Required skills
Key responsibilities
- Design the cybersecurity governance framework, including structure, decision rights, roles and RACI across the CISO office, IT, OT, risk, legal, procurement and business units
- Write and maintain the cybersecurity policy framework, from top-level policy to SOPs, mapped to NCA ECC-2:2024 and other applicable NCA controls
- Manage the document lifecycle through drafting, stakeholder review, approval, publication, communication, periodic review and version control
- Maintain ISMS governance components, including scope, context, roles and management review, toward ISO/IEC 27001:2022
- Define the cybersecurity roles and responsibilities matrix required by NCA ECC and keep it current
- Set up the cybersecurity steering committee and working groups with charters, membership, meeting calendars, agendas, minutes and action tracking
- Prepare decision-focused papers for executives and follow decisions and actions through to closure
- Build the integrated programme plan across all domains, with milestones, dependencies and critical path
- Own the RAID log and escalate blockers early along with options
- Control changes to scope, schedule and resources
- Track resourcing, onboarding, timesheets and budget against plan
- Produce weekly and monthly status reports, dashboards and executive summaries for leadership
- Coordinate with the SMO, CoE and domain leads so work flows smoothly across the programme
- Establish deliverable standards, including templates, quality review steps and acceptance criteria
- Conduct quality reviews and manage deliverable submission and formal acceptance
- Organize the programme document repository so evidence is easy to find for audits and regulators
Experience & skills
- Bring 5 to 10 years of total experience
- Hold a bachelor's degree in cybersecurity, IT, business or a related field
- Show experience designing or substantially updating a cybersecurity governance framework or policy suite (Senior), or writing policies, procedures or SOPs (Mid)
- Demonstrate proven PMO or programme management experience on large, multi-workstream programmes, including planning, RAID, change control and status reporting
- Know NCA ECC, ISO/IEC 27001 and NIST CSF 2.0
- Manage stakeholders and executive reporting with confidence
- Write clear, concise English
- Offer experience setting up and running steering committees in Saudi government or large private entities
- Use planning tools such as MS Project, Primavera or Smartsheet and build Power BI dashboards
- Work with ITIL service management functions
- Draw on a consulting background
- Possess at least one of PMP, CISM or CGEIT, with PgMP, PRINCE2 / MSP, ISO/IEC 27001 Lead Implementer or COBIT also valued (preferred)
- Speak Arabic (a plus)